This list of Frequently Asked Questions was adapted from the National Institutes of Health Certificate of Confidentiality Kiosk.

What is a Certificate of Confidentiality?

A federal law allows the HRSA and other federal agencies to issue Certificates of Confidentiality to persons engaged in sensitive biomedical, behavioral, clinical or other research, for the purpose of protecting the privacy of research subjects.  The authorizing federal law states that anyone who receives a Certificate of Confidentiality may not be compelled in any federal, state, or local civil, criminal, administrative, legislative, or other proceedings to identify the subjects of research covered by the Certificate.  Thus, the Certificates help minimize risks to subjects by adding an additional level of protection for maintaining confidentiality of private information.

This protection is not limited to federally funded research; Certificates may be issued to cover any study that the issuing federal agency deems to be appropriate.  Generally, research will be considered “sensitive” and eligible for Certificate protection if the study involves the collection of identifying information which, if revealed, could harm the financial standing, employability, insurability, or reputation of a research subject. Such information includes data about sexual attitudes and behavior, substance abuse, illegal conduct, psychiatric or genetic information, and much medical information.

Importantly, however, there are exceptions to the scope of protection afforded by a Certificate of Confidentiality. Certificates do not protect research subjects against the voluntary disclosure by the investigator of identifying information.  For example, a Certificate does not prevent an investigator from notifying the authorities if he or she obtains evidence of child abuse or a subject's threatened violence to self or others. In fact, JHM policies require investigators to comply with all such mandatory disclosure laws. Also, federal agency rights to audit research records are not eliminated by Certificates of Confidentiality. The consent form for a research study must inform study subjects that even when a Certificate has been obtained, the investigator can make certain disclosures.

See also, Office for Human Research Protections (OHRP) Guidance on Certificates of Confidentiality, February 25, 2003

Who may apply for a Certificate of Confidentiality?

Any person engaged in research in which sensitive information is gathered from human research participants (or any person who intends to engage in such research) may apply for a Certificate of Confidentiality.

When should an investigator seek a Certificate of Confidentiality for a study?

Before submitting a new application to the IRB, investigators should consider whether a Certificate of Confidentiality would be an added protection for study data.  If the investigator seeks to obtain identifying information of a sensitive nature from research participants, and the disclosure of such information could harm the participants as described above, the PI may wish to apply to the government for a Certificate of Confidentiality.  The investigator should state in the application to the IRB that he or she will seek a Certificate of Confidentiality after the IRB has reviewed the application.  Certificates are most important for grant-funded and investigator-initiated research.

What kind of research is eligible for a Certificate?

Generally, any research project that collects personally identifiable, sensitive information and that has been approved by an IRB operating under either an approved Federal-Wide Assurance issued by the Office of Human Research Protections or the approval of the Food and Drug Administration is eligible for a Certificate. Federal funding is not a prerequisite for a HRSA issued Certificate, but the subject matter of the study must fall within the mission area.

What is meant by sensitive information?

Sensitive information includes (but is not limited to) information relating to sexual attitudes, preferences, or practices; information relating to the use of alcohol, drugs, or other addictive products; information pertaining to illegal conduct; information that, if released, might be damaging to an individual's financial standing, employability, or reputation within the community or might lead to social stigmatization or discrimination; information pertaining to an individual's psychological well-being or mental health; and genetic information or tissue samples.

What are some examples of research projects that are eligible for a Certificate?

The following is an illustrative but not exhaustive list of research areas eligible for a Certificate:

• Research on HIV, AIDS, and other STDs;
• Studies that collect information on sexual attitudes, preferences, or practices;
• Studies on the use of alcohol, drugs, or other addictive products;
• Studies that collect information on illegal conduct;
• Studies that gather information that if released could be damaging to a participant's financial standing, employability, or reputation within the community;
• Research involving information that might lead to social stigmatization or discrimination if it were disclosed;
• Research on participants' psychological well being or mental health;
• Genetic studies, including those that collect and store biological samples for future use;
• Research on behavioral interventions and epidemiologic studies.

What studies would NOT be eligible?

Ineligible studies include projects that are:

• not research based,
• not approved by an IRB operating under either an approved Federal-Wide Assurance issued by the Office of Human Research Protections or the approval of the Food and Drug Administration,
• not collecting sensitive information or information that, if released publicly, might harm the research participants,
• not collecting personally identifiable information, or
• not involving a subject matter that is within a mission area of the HRSA.

What is the effect of a Certificate? What protection does it afford?

Researchers can use a Certificate to avoid compelled "involuntary disclosure" (e.g., subpoenas) of names and other identifying information about any individual who participates as a research subject (i.e., about whom the investigator maintains identifying information) during any time the Certificate is in effect. It does not protect against voluntary disclosures by the researcher, but those disclosures must be specified in the informed consent form. A researcher may not rely on the Certificate to withhold data if the participant consents in writing to the disclosure.

How long does a Certificate's protection last?

Individuals who participate as research subjects (i.e., about whom the investigator maintains identifying information) in the specified research project during any time the Certificate is in effect are protected permanently- even if the subject gave the researcher data before the Certificate is issued.

In what situations may personally identifiable information protected by a Certificate be disclosed?

Personally identifiable information protected by a Certificate may be disclosed under the following circumstances:

• Voluntary disclosure of information by study participants themselves or any disclosure that the study participant has consented to in writing, such as to insurers, employers, or other third parties;
• Voluntary disclosure by the researcher of information on such things as child abuse, reportable communicable diseases, possible threat to self or others, or other voluntary disclosures provided that such disclosures are spelled out in the informed consent form;
• Voluntary compliance by the researcher with reporting requirements of state laws, such as knowledge of communicable disease, provided such intention to report is specified in the informed consent form; or
• Release of information by researchers to DHHS as required for program evaluation or audits of research records or to the FDA as required under the federal Food, Drug, and Cosmetic Act (21 U.S.C. 301 et seq.).

When should I apply for a Certificate?

Generally, an application for a Certificate of Confidentiality is submitted after the Institutional Review Board (IRB) responsible for its review approves the research project (because IRB approval or approval conditioned upon issuance of a Certificate of Confidentiality is a prerequisite for issuance of a Certificate). Since the informed consent form should include language describing the Certificate and any voluntary disclosures specified by the investigator, the Applicant could tell the IRB that they are applying for a Certificate of Confidentiality and have included appropriate language in the informed consent form. Applications for Certificates should be submitted at least three months prior to the date on which enrollment of research subjects is expected to begin

What if there is a significant change in my research project after a Certificate is issued?

If a significant change in your research project is proposed after a Certificate is issued, you must inform the Certificate Coordinator of the Institute issuing the certificate by submitting an amended application for a Certificate of Confidentiality (in the same form and manner as your original application for a Certificate).

What do you mean by significant changes?

Significant changes include: major changes in the scope or direction of the research protocol, changes in personnel having major responsibilities in the project, or changes in the drugs to be administered (if any) and the persons who will administer them.

What if my research project extends beyond the expiration date on the Certificate?

If you determine that the research project for which you have received a Certificate of Confidentiality will extend beyond the expiration date on the Certificate, you may submit a written request for extension of the date. This request should be submitted to the HRSA at least three months prior to the Certificate's expiration. It must include an explanation of the reasons for requesting an extension (e.g., new subjects continue to be enrolled in the project), a revised estimate of the date for completion of the project, documentation of the Institutional Review Board's most recent approval for the project, and a copy of the consent form which should include language explaining the Certificate's protections, specify any voluntary disclosures, and clearly state any other limitations. If your request is approved, an amended Certificate will be issued.

What is the researcher's responsibility to participants regarding a Certificate of Confidentiality?

When a researcher obtains a Certificate of Confidentiality, the subjects must be told about protections afforded by the Certificate and any exceptions to those protections - i.e., the circumstances in which the investigators plan to disclose, voluntarily, identifying information about research participants (e.g., child abuse, harm to self or others, etc.). This information should be included in the informed consent form unless a research subject is no longer actively participating in the project so amendment of the informed consent would be impractical The researchers should eliminate provisions in consent form templates that may be inconsistent with the Certificate protections (such as references to disclosures required by law, since the Certificate enables researchers to resist disclosures that would otherwise be compelled by law). In addition, researchers may not represent the Certificate as an endorsement of the research project by the DHHS or use it in a coercive manner when recruiting subjects

What should an investigator do if legal action is brought to release personally identifying information protected by a certificate?

The researcher should immediately inform the Certificate Coordinator who issued the Certificate and seek legal counsel from his or her institution.

I'm conducting a longitudinal study. I just got a Certificate of Confidentiality. Part of my cohort was recruited prior to issuance of the Certificate, but they are no longer actively participating in the study. What do I do?

In the informed consent form, you should tell subjects who are still actively involved in your study that the Certificate is in effect. If subjects are no longer actively participating in the project, an amendment to the informed consent form would be impractical.

Both the PI and the Institutional Official must sign the application for a Certificate. What is meant by "Institutional Official"?

The authorized institutional official is the individual named by the applicant organization who is authorized to act for that organization and assumes on behalf of the institution the obligations imposed by assurances as well as obligations imposed by the Federal laws, regulations, requirements and other conditions that apply to grant applications and awards.

Does the Privacy Rule preclude the need for Certificates of Confidentiality?

No. Certificates of Confidentiality offer an important protection for the privacy of research study participants by protecting identifiable health information from forced disclosure (e.g., by court order). While the Privacy Rule does establish protections for covered entities’ use and disclosure of PHI, it permits use or disclosure in response to certain judicial or administrative orders. Therefore, researchers/contractors may obtain Certificates of Confidentiality to protect them from being forced to disclose information that would have to be disclosed under the Privacy Rule.

Does the Patriot Act affect the Certificate of Confidentiality protections?

No, a Certificate of Confidentiality protects investigators and institutions from being compelled to release information that could be used to identify study participants in any civil, criminal, administrative, legislative, or other proceeding, whether at the federal, state, or local level. The Patriot Act does not affect those protections.

Is the Certificate still valid if the original Principal Investigator is replaced by another investigator?

NO.  The Certificate is issued to an individual PI or sponsor.  If the PI of a study is replaced by another investigator, the Certificate must be amended to reflect that change.

Does the Certificate have an expiration date?

Yes.  The Certificate is issued for an explicit period of time.  Once it expires, any study information collected after that expiration is not protected.  The PI must renew the Certificate of Confidentiality, well in advance of its expiration, so that the entire period of data collection is protected.

Should the PI notify the issuing federal agency of any changes made to the protocol?

Yes, most Certificates of Confidentiality specify that the holder of the Certificate must notify the issuing agency of any changes to the protocol.

If a research project has already started, can one obtain a Certificate of Confidentiality that will cover subjects already enrolled?

Assuming that the project meets the eligibility criteria for the Certificate and that subjects are actively being recruited, previously enrolled subjects will be covered. The applicant should indicate the entire length of the study to be covered (start to finish) in the application letter. The Certificate issued should indicate that the research is already underway and that it will end on the stated date. The applicant should also take the Consent Form, revised according to suggested wording, to the IRB for approval prior to requesting the Certificate.